This application relates generally to network security and, more particularly, to network security software tools having novel information retrieval and display capabilities.
Communication networks have become ubiquitous. As such networks grow in size and complexity, so does the volume of threats directed toward those networks. Viruses, denial of service attacks and other unanticipated vulnerabilities that could permit unauthorized access to network resources have become pervasive and, with the increasing volume of traffic across communication networks, have become harder to detect.
Threat management software tools that alert system administrators to events that may present a threat to communications networks have become more popular. Such tools monitor network traffic for various forms of suspicious behavior, for example, if a computer at a particular IP address is scanning a large number of other IP addresses. Such behavior could indicate the presence of a worm or virus or an attempt to gain unauthorized access to a computer at one of the target IP addresses. One skilled in the art will recognize that myriad different threats to network data and communications exist that require detection and prevention.
One limitation with current threat management tools is that they are often unwieldy to use. For example, when an alert is generated, it is very important to be able to identify the location of a particular IP address within a network as well as the identity of the person who is assigned to that IP address. Some or all of such information may be only available in a stand alone database either internal or external to an organization. However, current threat management tools are not integrated with internal and external databases. Therefore, when an alert indicating suspicious activity originating or destined for a particular IP address is received, it is often difficult to accurately analyze the threat, requiring a security analyst to undertake a manual search of various sources of information in an attempt to resolve the threat. While the IP address may be associated with a particular user, the location of the user's computer and the identity of the user are typically not readily available. This results in frustration on the part of security analysts and delays in addressing security threats as they arose.
In accordance with the principles of the present invention, databases containing information related to an IP address are accessed directly from within a threat management software tool. When an alert is generated, an element within that alert, such as an IP address, is linked to one or more databases internal to an organization containing information related to the location or identity of a user or computer at a particular IP address. If no matches for that element are found in internal databases, a search of a registry of IP addresses, such as the well-known American Registry of Internet Numbers (ARIN), is conducted. Finally, if the searches of internal and external databases are inadequate, an active scan of the device at that particular IP address or a router associated with that IP address is conducted. In this way, information related to a security threat is easily and efficiently obtained to enable a security analyst to better isolate that threat.
These and other advantages of the invention will be apparent to those of ordinary skill in the art by reference to the following detailed description and the accompanying drawings.
As corporate networks, such as illustrative network 100, grow increasingly large, the number of threats faced by those networks also grows. These threats include worms, viruses, Trojan horses, denial of service attacks, attempts to gain unauthorized access to computer systems, and other potentially damaging security issues. Such threats are well known in the art and will not be described in detail herein other than as is necessary to understand the principles of the present invention. Due to the magnitude of the problem such threats pose, many corporations have instituted threat management procedures in order to detect security threats and prevent unauthorized access or damage to computer systems or data contained within such systems. For example, many corporations use well-known software tools monitored by security analysts to detect when a potential threat activity is present within a network. As is well-known, such threats may be characterized by a wide variety of behavior, such as a large number of scans from one IP address directed to other IP addresses or a large amount of uncharacteristic traffic directed to or from a particular IP address. When such activity is detected, for example, an alert is typically generated by a software monitoring tool. A security analyst can then initiate an investigation and, if warranted, take action to reduce the potential damage caused by this activity. For example, if a computer at an IP address within the corporate network is behaving suspiciously, a security analyst will attempt to determine if a reasonable explanation exists for that behavior and, if not, may want to isolate that computer from the network so that it can no longer send or receive network traffic. If traffic from an IP address external to the corporate intranet is exhibiting such suspicious behavior, the security analyst may want to block all traffic from that IP address from entering the intranet.
As discussed above, one problem with prior tools designed to monitor network traffic and alert security analysts to suspicious behavior is that they have typically been stand-alone systems. Specifically, prior security software tools typically provide an indication of an IP address and the activity that caused the alert to be generated. Then, it was the job of the security analyst to investigate the alert to determine whether it constituted a legitimate threat. In order to conduct this investigation, however, various types of information were required. For example, while an IP address indicates an address within a network, it is desirable to know where precisely the computer or other device having that IP address is located in relation to other devices, both physically and in terms of network topology. Additionally, information related to the computer, such as the Machine Access Control (MAC) address, is also desirable. However, in most cases, obtaining such information from only an IP address was difficult. Typically, if any such information was available, it was only available in a database separate not accessible directly from the security software tool. Frequently, this difficulty was compounded as multiple databases located from multiple sources had to be accessed in order to obtain the desired information. As a result, the time required to investigate and resolve potential security threats was longer than desired.
The present invention substantially solves these problems. In particular, in accordance with the principles of the present invention, when a security threat is detected by threat management software, an alert is generated. An exemplary record of such as an alert, stored for example in the memory of a computer, is shown in
Therefore, in one embodiment of the present invention, the security alert system represented by the display of
As discussed above, some of the most important information required by a security analyst is information related to the particular computers that are the source and target of a particular security alert. Specifically, the type of computer, operating system, network connections and both physical and network topology locations of the computer are highly important in order to assess a network threat and, if necessary, isolate potential security risks to the network. However, as also discussed above, this information was typically the most likely type of information to be either stored in a proprietary database maintained by a corporation or third party. Therefore, in accordance with another embodiment of the present invention, databases containing this information are also accessible via a hypertext link to that database. For example, by clicking on the Source IP of 135.210.96.46 in field 305 of
Referring only to company databases for information related to a computer may be insufficient to provide the security analyst with necessary information. For example, in some cases, the above information may not be available within an organization's database either because the respective organization does not maintain that information or because an error was made in entering information into the database. Therefore, in accordance with another embodiment, if a company's databases do not satisfy the need for information necessary to address a security alert, searches of third party databases may be automatically conducted from within the network security software tool. For example, the American Registry of Internet Numbers (ARIN) maintains a searchable database containing contact and registration information for resources registered with ARIN. ARIN's database contains IP addresses, autonomous system numbers, organizations or customers that are associated with these resources, and related points of contact. Additionally, ARIN maintains a routing registry database that provides a registration service whereby network operators submit, maintain and retrieve routing configuration information. Accordingly, if an organization does not maintain a consolidated database of computing resources, the one or more ARIN databases or similar databases may be automatically accessed via the network security software tool of the present invention.
After conducting this automated systematic search of databases from within the software, it may determined that insufficient information was retrieved to enable the security analyst to address the security alert. In this case, therefore, the systematic automatic data retrieval may be continued by actively scanning the actual computer and/or the router associated with that computer. Once again, the information obtained by such a scan may include the MAC address of the computer, the operating system, the type of computer, and information related to the routers through which the computer is connected to the network.
By utilizing the foregoing systematic approach to automatically searching for information related to a security alert, a security analyst can address any such alerts with greater speed and accuracy than was possible using prior methods.
One skilled in the art will recognize that computer 607 is merely illustrative in nature and that various hardware and software components may be adapted for equally advantageous use in a computer in accordance with the principles of the present invention.
The foregoing Detailed Description is to be understood as being in every respect illustrative and exemplary, but not restrictive, and the scope of the invention disclosed herein is not to be determined from the Detailed Description, but rather from the claims as interpreted according to the full breadth permitted by the patent laws. It is to be understood that the embodiments shown and described herein are only illustrative of the principles of the present invention and that various modifications may be implemented by those skilled in the art without departing from the scope and spirit of the invention. For example, one skilled in the art will recognize that, instead of automatically conducting the searches of databases for information and/or scanning computers suspected of being security risks, such searches/scans may be initiated by a separate click on a hyperlink. Additionally, as discussed above, such searches maybe conducted sequentially or simultaneously. Those skilled in the art could implement various other feature combinations without departing from the scope and spirit of the invention.
Number | Name | Date | Kind |
---|---|---|---|
6006264 | Colby et al. | Dec 1999 | A |
6189033 | Jin et al. | Feb 2001 | B1 |
6222856 | Krishnan et al. | Apr 2001 | B1 |
6473793 | Dillon | Oct 2002 | B1 |
6598034 | Kloth | Jul 2003 | B1 |
6789203 | Belissent | Sep 2004 | B1 |
20020178383 | Hrabik et al. | Nov 2002 | A1 |
20060195566 | Hurley | Aug 2006 | A1 |